EUVD-2026-22562
GHSA-vmwf-m9c5-3jvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing .NET application
-
DeliveryCraft request with special elements targeting auth bypass
-
ExploitSend malicious HTTP request to vulnerable endpoint
-
ExecutionRuntime fails to neutralize special characters
-
PersistSpoof legitimate user session
-
ImpactAccess confidential data without authentication
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Improper neutralization of special elements
|
| Exploitation Conditions | Remote unauthenticated attacker over network against .NET applications with improper input validation of special elements. No user interaction required. Affects default .NET configurations vulnerable to spoofing attacks through unvalidated network input. |
| Impact | The CVSS v3.1 score of 7.5 (High) reflects network-accessible exploitation (AV:N) requiring no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), resulting in high confidentiality impact (C:H) without integrity or availability effects. The attack vector characteristics indicate this vulnerability is readily exploitable by remote attackers without special access or social engineering. However, real-world risk assessment reveals important nuances: no CISA KEV listing indicates this is not confirmed as actively exploited in the wild, and no public proof-of-concept code has been identified at time of analysis. The CVSS vector shows unchanged scope (S:U), limiting blast radius to the vulnerable component itself. The 'spoofing' classification combined with high confidentiality impact suggests attackers can impersonate legitimate users or bypass authentication to access sensitive data, but cannot modify systems or cause denial of service. Given the ubiquitous deployment of .NET in enterprise environments, vendor-confirmed patches, and the no-authentication-required attack profile, this represents a genuine priority for organizations running internet-facing .NET applications, though the absence of confirmed exploitation provides a remediation window before active threats emerge. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends specially crafted HTTP requests to a vulnerable .NET web application or API endpoint, embedding special elements or escape sequences designed to bypass authentication validation logic. The .NET runtime improperly neutralizes these special characters, allowing the attacker to spoof legitimate user credentials or session tokens. With spoofed authentication, the attacker gains unauthorized read access to sensitive application data, user information, or confidential business records that would normally require authenticated access, achieving the high confidentiality impact reflected in the CVSS score. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Information disclosure in Microsoft .NET 8.0, 9.0, 10.0, and Visual Studio 2022 allows unauthenticated remote attackers to access sensitive data through improper neutralization of special elements. This spoofing vulnerability (CWE-138) enables attackers to bypass authentication mechanisms and extract high-confidentiality information over the network with low attack complexity. No active exploitation confirmed (not in CISA KEV), but the network-accessible, no-authentication-required attack profile presents immediate risk for internet-facing .NET applications. Vendor patches available for all affected versions.
RemediationAI
Immediately upgrade to patched versions: .NET 10.0.6 or later for 10.0 branch deployments, .NET 9.0.15 or later for 9.0 branch deployments, .NET 8.0.26 or later for 8.0 branch deployments, Visual Studio 2022 version 17.14.30 or later for 17.14 installations, and Visual Studio 2022 version 17.12.19 or later for 17.12 installations. Microsoft has released vendor-confirmed patches for all affected product versions through the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32178. Organizations should prioritize patching internet-facing .NET applications and API endpoints first, followed by internal systems and developer workstations running Visual Studio 2022. No workarounds have been published; upgrading to fixed versions is the only confirmed mitigation. Verify successful patch deployment by checking runtime version with 'dotnet --version' command and Visual Studio version through Help > About Microsoft Visual Studio menu.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 29 packages in microsoft, nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits CWE-138 (Improper Neutralization of Special Elements) within the .NET runtime framework and Visual Studio 2022 development environment. The flaw affects the .NET 8.0, 9.0, and 10.0 runtime branches, as well as Visual Studio 2022 versions 17.12 and 17.14. Special element neutralization weaknesses typically involve improper handling of control characters, escape sequences, or delimiter characters that can alter application logic. In the context of .NET authentication and identity subsystems, attackers can craft inputs containing special elements that bypass input validation or authentication checks, leading to spoofing attacks. The CPE data identifies Microsoft .NET runtime versions across three major release branches and two Visual Studio 2022 release channels as vulnerable, indicating a fundamental flaw in shared authentication or input handling components across the .NET ecosystem.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
Executive ViewAI
Microsoft .NET 8.0, 9.0, 10.0 and Visual Studio 2022 contain an information disclosure vulnerability that allows unauthenticated remote attackers to extract sensitive data without requiring authentication or user interaction. Organizations running internet-facing .NET applications are at immediate risk of confidential data exposure through network-based attacks with minimal complexity.
Apply vendor patch. Interim mitigations pending patch deployment: isolate internet-facing .NET applications behind Web Application Firewalls (WAF) configured to filter malicious requests; restrict network access to .NET services to authorized IP ranges; disable remote access features in Visual Studio 2022 if not actively required; monitor network traffic for suspicious data extraction patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB